Undertow: ajp request closes connection exceeding maxrequestsize
CVE-2023-5379
Key Information:
What is CVE-2023-5379?
A vulnerability exists in JBoss EAP affecting the handling of AJP requests that exceed the max-header-size attribute. This flaw allows an attacker to trigger an error state in mod_cluster, resulting in JBoss EAP closing the TCP connection and failing to return an AJP response. Attackers can exploit this by repeatedly sending oversized requests, leading to potential Denial of Service situations where legitimate user requests are disrupted.
Affected Version(s)
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:3.0.1-4.b08_redhat_00005.1.ep7.el7
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:5.1.17-3.Final_redhat_00004.1.ep7.el7
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7